Fix DedupeSessionCookies panic with pgxstore (use FindCtx)

Production uses pgxstore, whose plain scs.Store.Find deliberately panics
("missing context arg") — only FindCtx works. DedupeSessionCookies called
Store.Find directly, so any request carrying duplicate session cookies
500'd (chi Recoverer caught the panic). Unit tests passed because the
in-memory store implements plain Find.

Mirror scs.doStoreFind: type-assert FindCtx(context.Context, string) and
use it with the request context, falling back to plain Find for simple
stores. Regression test adds a ctx-only store whose plain methods panic.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/api/internal/httpapi/session_dedupe_test.go

@@ -1,6 +1,7 @@
 package httpapi
 
 import (
+	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -10,6 +11,27 @@ import (
 	"github.com/descrybe/descrybe-v2/apps/api/internal/config"
 )
 
+// ctxOnlyStore mimics pgxstore: the plain scs.Store methods PANIC and only the
+// *Ctx variants work. DedupeSessionCookies must use FindCtx for such stores.
+type ctxOnlyStore struct {
+	tokens map[string]bool
+}
+
+func (s *ctxOnlyStore) Find(string) ([]byte, bool, error)            { panic("missing context arg") }
+func (s *ctxOnlyStore) Commit(string, []byte, time.Time) error       { panic("missing context arg") }
+func (s *ctxOnlyStore) Delete(string) error                          { panic("missing context arg") }
+func (s *ctxOnlyStore) FindCtx(_ context.Context, token string) ([]byte, bool, error) {
+	return []byte("x"), s.tokens[token], nil
+}
+func (s *ctxOnlyStore) CommitCtx(_ context.Context, token string, _ []byte, _ time.Time) error {
+	s.tokens[token] = true
+	return nil
+}
+func (s *ctxOnlyStore) DeleteCtx(_ context.Context, token string) error {
+	delete(s.tokens, token)
+	return nil
+}
+
 func dedupeTestServer(t *testing.T) (*Server, *scs.SessionManager) {
 	t.Helper()
 	sm := scs.New() // in-memory store
@@ -71,6 +93,30 @@ func TestDedupeSessionCookies_staleShadowsValid(t *testing.T) {
 	}
 }
 
+func TestDedupeSessionCookies_ctxOnlyStoreNoPanic(t *testing.T) {
+	t.Parallel()
+	// Regression: production pgxstore panics on plain Find ("missing context
+	// arg") — the middleware must go through FindCtx.
+	s, sm := dedupeTestServer(t)
+	sm.Store = &ctxOnlyStore{tokens: map[string]bool{"valid-token": true}}
+
+	var seen string
+	h := s.DedupeSessionCookies(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		c, err := r.Cookie("descrybe_session")
+		if err != nil {
+			t.Fatalf("session cookie missing downstream: %v", err)
+		}
+		seen = c.Value
+	}))
+	req := httptest.NewRequest(http.MethodGet, "/api/auth/me", nil)
+	req.Header.Set("Cookie", "descrybe_session=stale-relic; descrybe_session=valid-token")
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req) // must not panic
+	if seen != "valid-token" {
+		t.Fatalf("downstream token=%q want valid-token", seen)
+	}
+}
+
 func TestDedupeSessionCookies_singleCookieUntouched(t *testing.T) {
 	t.Parallel()
 	s, _ := dedupeTestServer(t)